@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.4

package/dist/schemas/domain/attestation/provider.schema.js

@@ -0,0 +1,18 @@
+import { LocalAttestationToken } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { createAttestationOptionsSchema } from "./attestation.schema.js";
+/** Function schemas check callability without wrapping functions or changing their receivers. */
+export const localAttestationHandleSchema = z.object({
+    claimPath: z.string(),
+    verify: z.function({ input: [z.string().optional()], output: z.boolean() }),
+    dispose: z.function({ input: [], output: z.promise(z.void()) })
+});
+const create = z.function({ input: [createAttestationOptionsSchema], output: z.promise(localAttestationHandleSchema) });
+const read = z.function({ input: [z.string()], output: z.promise(z.instanceof(LocalAttestationToken)) });
+export const secretsAttestationProviderSchema = z.object({
+    createAttestation: create,
+    readAttestation: read,
+    createLocalAttestation: create,
+    readLocalAttestation: read
+});
+//# sourceMappingURL=provider.schema.js.map

package/dist/schemas/domain/attestation/provider.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.schema.js","sourceRoot":"","sources":["../../../../src/schemas/domain/attestation/provider.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAEzE,iGAAiG;AACjG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAGH,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,8BAA8B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;AACxH,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,iBAAiB,EAAE,MAAM;IACzB,eAAe,EAAE,IAAI;IACrB,sBAAsB,EAAE,MAAM;IAC9B,oBAAoB,EAAE,IAAI;CAC1B,CAAC,CAAC"}

package/dist/schemas/domain/config.schema.d.ts

@@ -0,0 +1,6 @@
+import * as z from 'zod/v4';
+export declare const SecretsConfigSchema: z.ZodObject<{
+    accountOrigin: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>;
+export type SecretsConfig = z.infer<typeof SecretsConfigSchema>;
+//# sourceMappingURL=config.schema.d.ts.map

package/dist/schemas/domain/config.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/domain/config.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,mBAAmB;;kBAE9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/domain/config.schema.js

@@ -0,0 +1,5 @@
+import * as z from 'zod/v4';
+export const SecretsConfigSchema = z.strictObject({
+    accountOrigin: z.url().optional()
+});
+//# sourceMappingURL=config.schema.js.map

package/dist/schemas/domain/config.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.schema.js","sourceRoot":"","sources":["../../../src/schemas/domain/config.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC"}

package/dist/schemas/domain/store/store.schema.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Secrets Store Descriptor Schema
+ *
+ * Defines the structure for secrets/store kind descriptors. Each descriptor
+ * represents a secrets storage backend (env-file, encrypted-local,
+ * host-credentials, platform-api, vault, and stores other packages own such
+ * as `auth/device-session` or the Cloudflare delivery targets).
+ */
+import * as z from 'zod/v4';
+export declare const EnvironmentTierSchema: z.ZodEnum<{
+    local: "local";
+    dev: "dev";
+    staging: "staging";
+    production: "production";
+}>;
+export type EnvironmentTier = z.infer<typeof EnvironmentTierSchema>;
+/**
+ * The backend id: open (rc05 §2.3), so a package that owns a store names its
+ * own backend without editing this one. Lowercase segments joined by `-` or
+ * `/`, e.g. `env-file`, `host-credentials`, `auth/device-session`.
+ */
+export declare const SecretsBackendSchema: z.ZodString;
+export type SecretsBackend = z.infer<typeof SecretsBackendSchema>;
+/**
+ * How a store is reached (rc05 §2.3).
+ * - `scope`: a candidate for unnamed lookups. Resolution keeps the scope
+ *   stores whose `tiers` include the declared tier and takes the highest
+ *   priority; a priority tie is `store-ambiguous`.
+ * - `by-id`: reachable only through `query.withId(id)` (a reference that
+ *   names the store). Identity-scoped stores and delivery targets.
+ */
+export declare const SecretsStoreSelectionSchema: z.ZodEnum<{
+    scope: "scope";
+    "by-id": "by-id";
+}>;
+export type SecretsStoreSelection = z.infer<typeof SecretsStoreSelectionSchema>;
+export declare const SecretsStoreDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"secrets/store">;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    backend: z.ZodString;
+    selection: z.ZodDefault<z.ZodEnum<{
+        scope: "scope";
+        "by-id": "by-id";
+    }>>;
+    managedCredentialValues: z.ZodOptional<z.ZodLiteral<true>>;
+    tiers: z.ZodArray<z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>>;
+    priority: z.ZodDefault<z.ZodNumber>;
+    config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type SecretsStoreDescriptor = z.input<typeof SecretsStoreDescriptorSchema>;
+/** The parsed descriptor the runtime holds: `selection` and `priority` are set. */
+export type ResolvedSecretsStoreDescriptor = z.output<typeof SecretsStoreDescriptorSchema>;
+/**
+ * Identity-scoped stores are an explicit capability, never a fallback for
+ * environment or infrastructure credentials. Consumers must resolve them by
+ * id after establishing the caller identity.
+ */
+export declare function isIdentityScopedSecretsStoreDescriptor(descriptor: {
+    id: string;
+    backend?: string;
+}): boolean;
+/** A `by-id` store: reachable only by naming it (`--backend <id>` / `.withId(id)`). */
+export declare function isOptInSecretsStoreDescriptor(descriptor: {
+    id: string;
+    selection?: SecretsStoreSelection;
+}): boolean;
+/** A `scope` store: a candidate for unnamed lookups. */
+export declare function isGenericSecretsStoreDescriptor(descriptor: {
+    id: string;
+    selection?: SecretsStoreSelection;
+}): boolean;
+//# sourceMappingURL=store.schema.d.ts.map

package/dist/schemas/domain/store/store.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/domain/store/store.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,qBAAqB;;;;;EAAoD,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aAE8D,CAAC;AAEhG,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;EAA6B,CAAC;AAEtE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;iBA4BvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,mFAAmF;AACnF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAE3F;;;;GAIG;AACH,wBAAgB,sCAAsC,CACrD,UAAU,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAET;AAED,uFAAuF;AACvF,wBAAgB,6BAA6B,CAAC,UAAU,EAAE;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,qBAAqB,CAAC;CAClC,GAAG,OAAO,CAEV;AAED,wDAAwD;AACxD,wBAAgB,+BAA+B,CAAC,UAAU,EAAE;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,qBAAqB,CAAC;CAClC,GAAG,OAAO,CAEV"}

package/dist/schemas/domain/store/store.schema.js

@@ -0,0 +1,68 @@
+/**
+ * Secrets Store Descriptor Schema
+ *
+ * Defines the structure for secrets/store kind descriptors. Each descriptor
+ * represents a secrets storage backend (env-file, encrypted-local,
+ * host-credentials, platform-api, vault, and stores other packages own such
+ * as `auth/device-session` or the Cloudflare delivery targets).
+ */
+import * as z from 'zod/v4';
+export const EnvironmentTierSchema = z.enum(['local', 'dev', 'staging', 'production']);
+/**
+ * The backend id: open (rc05 §2.3), so a package that owns a store names its
+ * own backend without editing this one. Lowercase segments joined by `-` or
+ * `/`, e.g. `env-file`, `host-credentials`, `auth/device-session`.
+ */
+export const SecretsBackendSchema = z
+    .string()
+    .regex(/^[a-z0-9]+(?:[-/][a-z0-9]+)*$/, 'A backend id is lowercase segments joined by - or /');
+/**
+ * How a store is reached (rc05 §2.3).
+ * - `scope`: a candidate for unnamed lookups. Resolution keeps the scope
+ *   stores whose `tiers` include the declared tier and takes the highest
+ *   priority; a priority tie is `store-ambiguous`.
+ * - `by-id`: reachable only through `query.withId(id)` (a reference that
+ *   names the store). Identity-scoped stores and delivery targets.
+ */
+export const SecretsStoreSelectionSchema = z.enum(['scope', 'by-id']);
+export const SecretsStoreDescriptorSchema = z.object({
+    id: z.string().min(1),
+    kind: z.literal('secrets/store'),
+    name: z.string().optional(),
+    description: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    enabled: z.boolean().optional(),
+    hardware: z.array(z.string()).optional(),
+    /** Backend type for this store */
+    backend: SecretsBackendSchema,
+    /**
+     * How the store is reached. A descriptor that does not say is a scope
+     * store; every framework store declares it.
+     */
+    selection: SecretsStoreSelectionSchema.default('scope'),
+    /** This store resolves values by id for records in the managed secret vault. */
+    managedCredentialValues: z.literal(true).optional(),
+    /** Environment tiers this store operates on */
+    tiers: z.array(EnvironmentTierSchema).min(1),
+    /** Scope-selection priority: the highest wins among the tier's scope stores. */
+    priority: z.number().int().default(0),
+    /** Backend-specific configuration key-value pairs */
+    config: z.record(z.string(), z.string()).optional()
+});
+/**
+ * Identity-scoped stores are an explicit capability, never a fallback for
+ * environment or infrastructure credentials. Consumers must resolve them by
+ * id after establishing the caller identity.
+ */
+export function isIdentityScopedSecretsStoreDescriptor(descriptor) {
+    return descriptor.id === 'platform-api' || descriptor.backend === 'platform-api';
+}
+/** A `by-id` store: reachable only by naming it (`--backend <id>` / `.withId(id)`). */
+export function isOptInSecretsStoreDescriptor(descriptor) {
+    return descriptor.selection === 'by-id';
+}
+/** A `scope` store: a candidate for unnamed lookups. */
+export function isGenericSecretsStoreDescriptor(descriptor) {
+    return !isOptInSecretsStoreDescriptor(descriptor);
+}
+//# sourceMappingURL=store.schema.js.map

package/dist/schemas/domain/store/store.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.schema.js","sourceRoot":"","sources":["../../../../src/schemas/domain/store/store.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAIvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,KAAK,CAAC,+BAA+B,EAAE,qDAAqD,CAAC,CAAC;AAIhG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAItE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC,kCAAkC;IAClC,OAAO,EAAE,oBAAoB;IAE7B;;;OAGG;IACH,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,OAAO,CAAC;IACvD,gFAAgF;IAChF,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAEnD,+CAA+C;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,gFAAgF;IAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAErC,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAOH;;;;GAIG;AACH,MAAM,UAAU,sCAAsC,CACrD,UAA4C;IAE5C,OAAO,UAAU,CAAC,EAAE,KAAK,cAAc,IAAI,UAAU,CAAC,OAAO,KAAK,cAAc,CAAC;AAClF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,6BAA6B,CAAC,UAG7C;IACA,OAAO,UAAU,CAAC,SAAS,KAAK,OAAO,CAAC;AACzC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,+BAA+B,CAAC,UAG/C;IACA,OAAO,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC"}

package/dist/schemas/domain/store/store.types.d.ts

@@ -0,0 +1,63 @@
+import * as z from 'zod/v4';
+export declare const SecretEntrySchema: z.ZodObject<{
+    key: z.ZodString;
+    hasValue: z.ZodBoolean;
+    source: z.ZodString;
+}, z.core.$strip>;
+export type SecretEntry = z.infer<typeof SecretEntrySchema>;
+/** Opaque operation provenance remains in memory and is never serialized by a store. */
+export declare const StoreOperationContextSchema: z.ZodReadonly<z.ZodObject<{
+    traceId: z.ZodOptional<z.ZodString>;
+}, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>;
+export type StoreOperationContext = z.infer<typeof StoreOperationContextSchema>;
+/** Callable validation retains the supplied functions and their store receiver. */
+export declare const SecretsStoreImplementationSchema: z.ZodObject<{
+    id: z.ZodString;
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"secrets/store">;
+        name: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        backend: z.ZodString;
+        selection: z.ZodDefault<z.ZodEnum<{
+            scope: "scope";
+            "by-id": "by-id";
+        }>>;
+        managedCredentialValues: z.ZodOptional<z.ZodLiteral<true>>;
+        tiers: z.ZodArray<z.ZodEnum<{
+            local: "local";
+            dev: "dev";
+            staging: "staging";
+            production: "production";
+        }>>;
+        priority: z.ZodDefault<z.ZodNumber>;
+        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    list: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        hasValue: z.ZodBoolean;
+        source: z.ZodString;
+    }, z.core.$strip>>>>;
+    get: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodOptional<z.ZodString>>>;
+    set: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodVoid>>;
+    unset: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodVoid>>;
+    getAll: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    setAll: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>, z.ZodOptional<z.ZodReadonly<z.ZodObject<{
+        traceId: z.ZodOptional<z.ZodString>;
+    }, z.core.$catchall<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>>>>], null>, z.ZodPromise<z.ZodVoid>>;
+}, z.core.$strip>;
+export type SecretsStoreImplementation = Omit<z.infer<typeof SecretsStoreImplementationSchema>, 'descriptor'> & Readonly<Pick<z.input<typeof SecretsStoreImplementationSchema>, 'descriptor'>>;
+//# sourceMappingURL=store.types.d.ts.map

package/dist/schemas/domain/store/store.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.types.d.ts","sourceRoot":"","sources":["../../../../src/schemas/domain/store/store.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,wFAAwF;AACxF,eAAO,MAAM,2BAA2B;;+GAEuD,CAAC;AAChG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAKhF,mFAAmF;AACnF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,EAAE,YAAY,CAAC,GAC1G,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC"}

package/dist/schemas/domain/store/store.types.js

@@ -0,0 +1,25 @@
+import * as z from 'zod/v4';
+import { SecretsStoreDescriptorSchema } from "./store.schema.js";
+export const SecretEntrySchema = z.object({
+    key: z.string(),
+    hasValue: z.boolean(),
+    source: z.string()
+});
+/** Opaque operation provenance remains in memory and is never serialized by a store. */
+export const StoreOperationContextSchema = z.object({
+    traceId: z.string().optional()
+}).catchall(z.union([z.string(), z.number(), z.boolean(), z.null(), z.undefined()])).readonly();
+const operation = StoreOperationContextSchema.optional();
+const values = z.record(z.string(), z.string());
+/** Callable validation retains the supplied functions and their store receiver. */
+export const SecretsStoreImplementationSchema = z.object({
+    id: z.string(),
+    descriptor: SecretsStoreDescriptorSchema,
+    list: z.function({ input: [z.string(), operation], output: z.promise(z.array(SecretEntrySchema)) }),
+    get: z.function({ input: [z.string(), z.string(), operation], output: z.promise(z.string().optional()) }),
+    set: z.function({ input: [z.string(), z.string(), z.string(), operation], output: z.promise(z.void()) }),
+    unset: z.function({ input: [z.string(), z.string(), operation], output: z.promise(z.void()) }),
+    getAll: z.function({ input: [z.string(), operation], output: z.promise(values) }),
+    setAll: z.function({ input: [z.string(), values, operation], output: z.promise(z.void()) })
+});
+//# sourceMappingURL=store.types.js.map

package/dist/schemas/domain/store/store.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.types.js","sourceRoot":"","sources":["../../../../src/schemas/domain/store/store.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAGH,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGhG,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,EAAE,CAAC;AACzD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEhD,mFAAmF;AACnF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,4BAA4B;IACxC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;IACnG,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzG,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACxG,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACjF,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;CAC3F,CAAC,CAAC"}

package/dist/schemas/domain/testing/filesystem.schema.d.ts

@@ -0,0 +1,39 @@
+import type { FileEncoding, FileSystemAdapterInterface } from '@vibesdotdev/filesystem';
+import { type FileSystemAdapterDescriptor } from '@vibesdotdev/filesystem/schemas/adapter-descriptor';
+/** The adapter interface implemented by the secrets in-memory double. */
+export interface FilesystemDoubleAdapter extends FileSystemAdapterInterface {
+    readFilePrivate(path: string, maxBytes: number): Promise<Uint8Array>;
+    writeFilePrivate(path: string, data: string | Uint8Array, encoding?: FileEncoding): Promise<void>;
+    removeFilePrivateIfContent(path: string, expected: Uint8Array): Promise<boolean>;
+}
+/** A recorded view of what the adapter was asked to do. */
+export interface FilesystemDouble {
+    /** The underlying adapter implementation. */
+    readonly adapter: FilesystemDoubleAdapter;
+    /** Paths to contents. */
+    readonly files: Map<string, string>;
+    /** Every path a read was called with, in order (a bounded read records only inside the cap). */
+    readonly reads: string[];
+    /** Paths whose read fails with this errno (default `EACCES`). */
+    readonly unreadable: Map<string, string>;
+    /** A size `stat` reports in place of the real one: a FIFO, or a file that grew after it was measured. */
+    readonly statSizes: Map<string, number>;
+    /**
+     * The descriptor's declared capabilities, mutable: a test that needs an
+     * adapter that cannot bound a read empties this list before its call. The
+     * implementation reads this same array, so the mutation is what the
+     * production path sees.
+     */
+    readonly capabilities: FileSystemAdapterDescriptor['capabilities'];
+    /** The descriptor as registered, so a test can assert on it. */
+    readonly descriptor: FileSystemAdapterDescriptor;
+    /** When set, owner-private operations refuse with `filesystem-private-parent-shared`. */
+    sharedParent?: boolean;
+}
+/** Options for configuring the in-memory double. */
+export interface FilesystemDoubleOptions {
+    readonly capabilities?: FileSystemAdapterDescriptor['capabilities'];
+    readonly files?: Record<string, string> | Map<string, string>;
+    readonly sharedParent?: boolean;
+}
+//# sourceMappingURL=filesystem.schema.d.ts.map

package/dist/schemas/domain/testing/filesystem.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.schema.d.ts","sourceRoot":"","sources":["../../../../src/schemas/domain/testing/filesystem.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAC,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EACP,KAAK,2BAA2B,EAC/B,MAAM,oDAAoD,CAAC;AAE5D,yEAAyE;AACzE,MAAM,WAAW,uBAAwB,SAAQ,0BAA0B;IAC1E,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrE,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,yBAAyB;IACzB,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yGAAyG;IACzG,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC,cAAc,CAAC,CAAC;IACnE,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAC;IACjD,yFAAyF;IACzF,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,2BAA2B,CAAC,cAAc,CAAC,CAAC;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CAChC"}

package/dist/schemas/domain/testing/filesystem.schema.js

@@ -0,0 +1,2 @@
+import {} from '@vibesdotdev/filesystem/schemas/adapter-descriptor';
+//# sourceMappingURL=filesystem.schema.js.map

package/dist/schemas/domain/testing/filesystem.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.schema.js","sourceRoot":"","sources":["../../../../src/schemas/domain/testing/filesystem.schema.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,MAAM,oDAAoD,CAAC"}

package/dist/schemas/execution/audit.schema.d.ts

@@ -0,0 +1,44 @@
+import * as z from 'zod/v4';
+export declare const LeverageHopSchema: z.ZodObject<{
+    backend: z.ZodString;
+    environment: z.ZodString;
+    resolved: z.ZodArray<z.ZodString>;
+    writeOnly: z.ZodArray<z.ZodString>;
+    missing: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type LeverageHop = z.infer<typeof LeverageHopSchema>;
+export declare const LeverageLeaseAuditSchema: z.ZodObject<{
+    name: z.ZodString;
+    source: z.ZodLiteral<"lease">;
+    id: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type LeverageLeaseAudit = z.infer<typeof LeverageLeaseAuditSchema>;
+export declare const LeverageAuditRecordSchema: z.ZodObject<{
+    action: z.ZodUnion<readonly [z.ZodLiteral<"secrets.exec">, z.ZodLiteral<"secrets.request">, z.ZodLiteral<"secrets.oauth-client.mint">, z.ZodLiteral<"secrets.spawn">]>;
+    keys: z.ZodArray<z.ZodString>;
+    environment: z.ZodString;
+    backend: z.ZodString;
+    target: z.ZodString;
+    outcome: z.ZodUnion<readonly [z.ZodLiteral<"success">, z.ZodLiteral<"failure">]>;
+    reason: z.ZodOptional<z.ZodString>;
+    hops: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        backend: z.ZodString;
+        environment: z.ZodString;
+        resolved: z.ZodArray<z.ZodString>;
+        writeOnly: z.ZodArray<z.ZodString>;
+        missing: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+    leases: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        source: z.ZodLiteral<"lease">;
+        id: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type LeverageAuditRecord = z.infer<typeof LeverageAuditRecordSchema>;
+export declare const LeverageAuditOutputSchema: z.ZodObject<{
+    warn: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+}, z.core.$strip>;
+export type LeverageAuditOutput = z.infer<typeof LeverageAuditOutputSchema>;
+//# sourceMappingURL=audit.schema.d.ts.map

package/dist/schemas/execution/audit.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/audit.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,iBAAiB;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,wBAAwB;;;;;iBAKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;iBAUpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/schemas/execution/audit.schema.js

@@ -0,0 +1,29 @@
+import * as z from 'zod/v4';
+export const LeverageHopSchema = z.object({
+    backend: z.string(),
+    environment: z.string(),
+    resolved: z.array(z.string()),
+    writeOnly: z.array(z.string()),
+    missing: z.array(z.string()),
+});
+export const LeverageLeaseAuditSchema = z.object({
+    name: z.string(),
+    source: z.literal('lease'),
+    id: z.string().optional(),
+    expiresAt: z.string(),
+});
+export const LeverageAuditRecordSchema = z.object({
+    action: z.union([z.literal('secrets.exec'), z.literal('secrets.request'), z.literal('secrets.oauth-client.mint'), z.literal('secrets.spawn')]),
+    keys: z.array(z.string()),
+    environment: z.string(),
+    backend: z.string(),
+    target: z.string(),
+    outcome: z.union([z.literal('success'), z.literal('failure')]),
+    reason: z.string().optional(),
+    hops: z.array(LeverageHopSchema).optional(),
+    leases: z.array(LeverageLeaseAuditSchema).optional(),
+});
+export const LeverageAuditOutputSchema = z.object({
+    warn: z.function({ input: [z.string()], output: z.void() }),
+});
+//# sourceMappingURL=audit.schema.js.map

package/dist/schemas/execution/audit.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/audit.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9I,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;CAC3D,CAAC,CAAC"}

package/dist/schemas/execution/bootstrap.schema.d.ts

@@ -0,0 +1,79 @@
+import * as z from 'zod/v4';
+export declare const BootstrapCredentialEnvironmentNameSchema: z.ZodString;
+export declare const BootstrapCredentialExecRequestSchema: z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    credentials: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    references: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    redactions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>>>;
+    pass: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type BootstrapCredentialExecRequest = z.input<typeof BootstrapCredentialExecRequestSchema>;
+export declare const BootstrapCredentialAuditReasonSchema: z.ZodEnum<{
+    "credential-not-set": "credential-not-set";
+    "secret-value-invalid": "secret-value-invalid";
+    "spawn-options-invalid": "spawn-options-invalid";
+    "credential-name-duplicate": "credential-name-duplicate";
+    "credential-in-argv": "credential-in-argv";
+    "spawn-failed": "spawn-failed";
+    "output-failed": "output-failed";
+    "child-failed": "child-failed";
+    "audit-failed": "audit-failed";
+}>;
+export declare const BootstrapCredentialAuditSchema: z.ZodObject<{
+    action: z.ZodLiteral<"bootstrap-credentialed-process">;
+    target: z.ZodLiteral<"package-install">;
+    credentialNames: z.ZodArray<z.ZodString>;
+    outcome: z.ZodEnum<{
+        success: "success";
+        failure: "failure";
+    }>;
+    reason: z.ZodOptional<z.ZodEnum<{
+        "credential-not-set": "credential-not-set";
+        "secret-value-invalid": "secret-value-invalid";
+        "spawn-options-invalid": "spawn-options-invalid";
+        "credential-name-duplicate": "credential-name-duplicate";
+        "credential-in-argv": "credential-in-argv";
+        "spawn-failed": "spawn-failed";
+        "output-failed": "output-failed";
+        "child-failed": "child-failed";
+        "audit-failed": "audit-failed";
+    }>>;
+    exitCode: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type BootstrapCredentialAudit = z.infer<typeof BootstrapCredentialAuditSchema>;
+export declare const BootstrapCredentialErrorCodeSchema: z.ZodEnum<{
+    INVALID_INPUT: "INVALID_INPUT";
+    UNAVAILABLE: "UNAVAILABLE";
+    INTERNAL: "INTERNAL";
+}>;
+export type BootstrapCredentialErrorCode = z.infer<typeof BootstrapCredentialErrorCodeSchema>;
+export type BootstrapCredentialAuditReason = z.infer<typeof BootstrapCredentialAuditReasonSchema>;
+export declare const BootstrapCredentialSpawnOptionsSchema: z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+    cwd: z.ZodOptional<z.ZodString>;
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    envMode: z.ZodLiteral<"replace">;
+    stdin: z.ZodLiteral<"inherit">;
+    stdout: z.ZodLiteral<"pipe">;
+    stderr: z.ZodLiteral<"pipe">;
+}, z.core.$strict>;
+export type BootstrapCredentialSpawnOptions = z.infer<typeof BootstrapCredentialSpawnOptionsSchema>;
+export interface BootstrapCredentialChild {
+    readonly stdout: ReadableStream<Uint8Array> | null;
+    readonly stderr: ReadableStream<Uint8Array> | null;
+    readonly exited: Promise<number>;
+}
+export interface BootstrapCredentialPorts {
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    spawn(options: BootstrapCredentialSpawnOptions): Promise<BootstrapCredentialChild>;
+    stdout(text: string): void;
+    stderr(text: string): void;
+    audit(record: BootstrapCredentialAudit): void;
+}
+//# sourceMappingURL=bootstrap.schema.d.ts.map

package/dist/schemas/execution/bootstrap.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/bootstrap.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,wCAAwC,aAA+C,CAAC;AAErG,eAAO,MAAM,oCAAoC;;;;;;;;;;;kBAW/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,oCAAoC;;;;;;;;;;EAU/C,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;kBAOzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,kCAAkC;;;;EAAuD,CAAC;AACvG,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,qCAAqC;;;;;;;;;kBAShD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC;CAC9C"}

package/dist/schemas/execution/bootstrap.schema.js

@@ -0,0 +1,45 @@
+import * as z from 'zod/v4';
+export const BootstrapCredentialEnvironmentNameSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+export const BootstrapCredentialExecRequestSchema = z.strictObject({
+    command: z.string().min(1),
+    args: z.array(z.string()).default([]),
+    cwd: z.string().optional(),
+    credentials: z.record(BootstrapCredentialEnvironmentNameSchema, z.string().min(1)).default({}),
+    references: z.array(BootstrapCredentialEnvironmentNameSchema).default([]),
+    redactions: z.array(z.strictObject({
+        name: BootstrapCredentialEnvironmentNameSchema,
+        value: z.string().min(1)
+    })).default([]),
+    pass: z.array(BootstrapCredentialEnvironmentNameSchema).default([])
+});
+export const BootstrapCredentialAuditReasonSchema = z.enum([
+    'spawn-options-invalid',
+    'credential-not-set',
+    'credential-name-duplicate',
+    'secret-value-invalid',
+    'credential-in-argv',
+    'spawn-failed',
+    'output-failed',
+    'child-failed',
+    'audit-failed'
+]);
+export const BootstrapCredentialAuditSchema = z.strictObject({
+    action: z.literal('bootstrap-credentialed-process'),
+    target: z.literal('package-install'),
+    credentialNames: z.array(BootstrapCredentialEnvironmentNameSchema),
+    outcome: z.enum(['success', 'failure']),
+    reason: BootstrapCredentialAuditReasonSchema.optional(),
+    exitCode: z.number().int().optional()
+});
+export const BootstrapCredentialErrorCodeSchema = z.enum(['INVALID_INPUT', 'UNAVAILABLE', 'INTERNAL']);
+export const BootstrapCredentialSpawnOptionsSchema = z.strictObject({
+    command: z.string().min(1),
+    args: z.array(z.string()),
+    cwd: z.string().optional(),
+    env: z.record(BootstrapCredentialEnvironmentNameSchema, z.string()),
+    envMode: z.literal('replace'),
+    stdin: z.literal('inherit'),
+    stdout: z.literal('pipe'),
+    stderr: z.literal('pipe')
+});
+//# sourceMappingURL=bootstrap.schema.js.map

package/dist/schemas/execution/bootstrap.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/bootstrap.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAErG,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,wCAAwC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAClC,IAAI,EAAE,wCAAwC;QAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACf,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1D,uBAAuB;IACvB,oBAAoB;IACpB,2BAA2B;IAC3B,sBAAsB;IACtB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,cAAc;IACd,cAAc;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;AAIvG,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,wCAAwC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC"}

package/dist/schemas/execution/environment.schema.d.ts

@@ -0,0 +1,17 @@
+import * as z from 'zod/v4';
+export declare const ResolvedSecretsEnvironmentSchema: z.ZodObject<{
+    name: z.ZodString;
+    tier: z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>;
+}, z.core.$strip>;
+export type ResolvedSecretsEnvironment = z.infer<typeof ResolvedSecretsEnvironmentSchema>;
+export declare const SecretsEnvironmentReporterSchema: z.ZodObject<{
+    warn: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodVoid>;
+}, z.core.$strip>;
+export type SecretsEnvironmentReporter = z.infer<typeof SecretsEnvironmentReporterSchema>;
+export type EnvironmentSelectionRuntime = Pick<import('@vibesdotdev/kernel').RuntimeRef, 'scope'>;
+//# sourceMappingURL=environment.schema.d.ts.map

package/dist/schemas/execution/environment.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/execution/environment.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,gCAAgC;;;;;;;;iBAG3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAAC,OAAO,qBAAqB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC"}

package/dist/schemas/execution/environment.schema.js

@@ -0,0 +1,10 @@
+import * as z from 'zod/v4';
+import { EnvironmentTierSchema } from "../../domain/kinds/store.schema.js";
+export const ResolvedSecretsEnvironmentSchema = z.object({
+    name: z.string(),
+    tier: EnvironmentTierSchema,
+});
+export const SecretsEnvironmentReporterSchema = z.object({
+    warn: z.function({ input: [z.string()], output: z.void() }),
+});
+//# sourceMappingURL=environment.schema.js.map

package/dist/schemas/execution/environment.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.schema.js","sourceRoot":"","sources":["../../../src/schemas/execution/environment.schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,qBAAqB;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;CAC3D,CAAC,CAAC"}